Autonomous AI agents targeted more than 1,200 company websites

Criminals used autonomous AI agents to probe more than 1,200 websites and reach systems belonging to more than 100 companies, according to reporting by Reuters and an investigation from security researchers at NorForge.¹² The operation appears to have been run with limited human input, turning an AI penetration-testing framework called Cairn into a tool for real-world break-ins.

The activity was uncovered after NorForge found exposed Cairn control panels on the public internet. The panels showed operators directing agents towards online shops and other websites, while also revealing the targets, attack progress and in some cases credentials or API keys.² NorForge said more than 20 exposed panels appeared likely to be linked to malicious activity, while other unsecured panels contained apparently legitimate penetration tests whose customers could also have been put at risk.

What the agents were doing

Cairn is designed as a state-based problem-solving engine. A user gives it a starting point and an objective, and its agents work through intermediate discoveries and instructions on a shared project board.² That can be useful for authorised security testing, but the exposed panels documented by NorForge show the same workflow being aimed at websites without permission.

Reuters reported that the attackers’ records covered more than 1,200 projects and included websites belonging to companies such as Deere, SharkNinja and Cummins.¹ NorForge’s research identified a major Chinese-language activity cluster connected to more than 1,100 attack projects across 14 panels. The group appeared to target e-commerce and payment infrastructure in the United States, Japan and Australia, with the apparent aim of maintaining access for later use.²

The agents were instructed to look for weaknesses including unauthenticated code execution, unsafe file uploads, SQL injection, authentication bypasses and account-takeover paths.¹² In one documented pattern, a successful intrusion ended with a web-shell uploader being placed on a compromised site. NorForge said it independently validated one large US retailer compromise, while the precise impact varied between victims.

The companies named by Reuters told the newspaper that the damage was limited or that they were investigating. Deere said it had fixed the issue and found no evidence that sensitive information was accessed. SharkNinja said the affected site was a standalone product-support service and that it had contained the threat. Cummins said it was investigating a possible attack on a vendor-operated website.¹

Why the exposed panels matter

The control panels were not just a window into the attackers’ methods. NorForge said they exposed information about targets, vulnerabilities, credentials and stolen keys. Its scan of panel data found hundreds of secrets, with 11 per cent verified as still valid.² The researchers redacted sensitive details and did not publish addresses for live panels containing private information.

NorForge also stressed that the campaign is not evidence that Cairn itself was created for criminal use. The framework’s author told Reuters that it was built for authorised penetration testing and that harmful use was not the intention.¹ The problem is the combination of a capable automation framework, cheap model calls, exposed operator infrastructure and targets that can be tested continuously without a person supervising every step.

For defenders, the immediate lessons are less exotic than the headline. Organisations should look for exposed AI control panels, unexpected upload forms and unpatched e-commerce software, while treating credentials found in logs or dashboards as compromised. NorForge also warned that legitimate security firms can expose their own customers when they leave real tests on unsecured panels.²

Our opinion

The important shift is not that AI has discovered a brand-new class of vulnerability. It is that a short instruction can now be turned into hours of persistent reconnaissance, testing and follow-up with very little supervision. That lowers the cost of trying an attack and increases the number of targets a small operation can touch. The answer is not to ban every security agent; it is to secure the dashboards, restrict credentials, monitor unusual upload and authentication activity, and make sure automated testing is authorised before it starts.

Cairn’s exposed panels also show why organisations need to treat their own security tooling as production infrastructure. A penetration test that leaks its targets and secrets can create a second incident even when the test itself is legitimate.